In 2009 Peleus Uhley (of Adobe) and I gave a chat about RIA security at Microsoft's Bluehat security conference. I neglected to post a link, so here it is now, a year-and-a-half late.
We've released Silverlight 4 since then, but same ideas and attacks...